mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-08-06 19:35:31 +00:00
bc4dcf703b
#622 reported "I cant even paste that hash pw and granted So auth_en =false & localbypass= true But then the host still is showing login page?" — the operator turned auth off in .env and still gets bounced to /login on every page load. The flow: The auth middleware in app.py is correctly gated on AUTH_ENABLED, so the middleware itself does not install when AUTH_ENABLED=false. The SPA front-end at static/app.js wraps window.fetch and redirects to /login on ANY 401 response from any API call. So all it takes for the operator to see a login page is one route-level 401. src/auth_helpers.require_user — the shared FastAPI dependency mounted on ~50 routes (email, contacts, personal, …) — was the source. It is documented as defense-in-depth in case the middleware was bypassed unexpectedly (SSRF from a sibling service), but the implementation treated AUTH_ENABLED=false as one of those unexpected bypasses and 401'd anyway. The loopback fall-through that would have admitted the operator does not fire under docker compose / a reverse proxy because the container sees the request arriving from the bridge gateway (172.x.x.x), not 127.0.0.1. require_user now short-circuits to "" when AUTH_ENABLED=false so the explicit operator opt-out reaches the route layer too. While in the file, also mirror LOCALHOST_BYPASS=true the same way for loopback callers — the middleware already lets them through, and routes 401'ing the same caller would produce the same /login bounce. Non-loopback callers under LOCALHOST_BYPASS are still rejected, matching the middleware's _is_trusted_loopback check. Add three focused regression tests in tests/test_security_regressions.py: docker-bridge caller is admitted under AUTH_ENABLED=false, loopback caller is admitted under LOCALHOST_BYPASS=true, LAN caller under LOCALHOST_BYPASS=true is still rejected. The existing test_require_user_rejects_unauthenticated and test_require_user_accepts_loopback_when_unconfigured tests continue to pass because neither sets AUTH_ENABLED, so the AUTH_ENABLED=true default path is unchanged. Closes #622. |
||
|---|---|---|
| .. | ||
| bombadil-spec.ts | ||
| conftest.py | ||
| test_action_intents.py | ||
| test_agent_loop.py | ||
| test_app.py | ||
| test_app_static_mime.py | ||
| test_auth_event_loop.py | ||
| test_auth_regressions.py | ||
| test_auth_session_revocation.py | ||
| test_backup_cli_security.py | ||
| test_calendar_owner_scope.py | ||
| test_calendar_recurrence.py | ||
| test_chat_stream_scope.py | ||
| test_chroma_client.py | ||
| test_companion_readonly.py | ||
| test_compare_js.py | ||
| test_context_compactor.py | ||
| test_cookbook_helpers.py | ||
| test_deep_research_extraction_controls.py | ||
| test_document_tool_owner_scope.py | ||
| test_endpoint_resolver.py | ||
| test_esc_menu_stack_js.py | ||
| test_gallery_image_privileges.py | ||
| test_hwfit_macos.py | ||
| test_keybind_altgr_js.py | ||
| test_llm_core_anthropic_cache.py | ||
| test_llm_core_concurrency.py | ||
| test_llm_core_ollama.py | ||
| test_llm_core_sanitize_tool_calls.py | ||
| test_model_context.py | ||
| test_model_routes.py | ||
| test_null_owner_gates.py | ||
| test_pdf_runtime.py | ||
| test_personal_docs_pdf_index.py | ||
| test_personal_upload_isolation.py | ||
| test_provider_detection.py | ||
| test_rate_limiter.py | ||
| test_reply_recipients_js.py | ||
| test_research_session_id_validation.py | ||
| test_research_utils.py | ||
| test_reserved_username_admin_escalation.py | ||
| test_review_regressions.py | ||
| test_search_cache_invalidation.py | ||
| test_search_query.py | ||
| test_search_ranking.py | ||
| test_security_regressions.py | ||
| test_session_mode_helpers.py | ||
| test_settings_scrub.py | ||
| test_setup_admin_user.py | ||
| test_shell_routes.py | ||
| test_skill_index_prompt_injection.py | ||
| test_skills_manager_owner_isolation.py | ||
| test_speech_service_toggles.py | ||
| test_task_scheduler_session_delivery.py | ||
| test_vision_model_detection.py | ||
| test_visual_report.py | ||
| test_webhook_trigger_auth_exempt.py | ||